Unrated

IDOR in Sylius Shop Payment Request API

IdentifiersCVE-2026-53639CWE-639

CVE-2026-53639 is an insecure direct object reference vulnerability in Sylius Shop Payment Request API endpoints. The flaw allows access control to be bypassed when payment requests or related orders are referenced using identifiers such as a payment request hash or an order token value without sufficient ownership validation. An attacker who knows or obtains a valid payment request hash can retrieve payment request information and derive the associated order token, which can then be used to access full order details. The affected functionality also permits unauthorized modification of redirect-related payment request fields, including values used to control post-payment navigation. In addition, the payment-request creation endpoint for shop orders allows unauthorized access to orders based solely on token-based reference data rather than verified authorization context.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation exposes sensitive order and customer information, including order contents, addresses, customer email information, and financial totals. The vulnerability also enables unauthorized modification of redirect-related fields in payment requests, allowing an attacker to influence buyer navigation and potentially redirect victims to attacker-controlled destinations. This creates risks of privacy breach, session or workflow manipulation, phishing, and abuse of the checkout or payment flow.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, implement explicit ownership validation on all affected endpoints. Restrict GET access to payment requests so only the authenticated customer or permitted guest order context can access the resource. Decorate the PUT state provider to verify ownership before returning or updating payment request objects. Add command-bus middleware for the shop order payment-request creation endpoint to validate that the requester is authorized to act on the referenced order before handler execution. After deploying these controls, clear the application cache.

Remediation

Patch, then assume compromise.

Upgrade Sylius to a fixed version appropriate for the deployed branch. Fixed releases are 2.0.18, 2.1.15, and 2.2.6.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

SyliusSyliusapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity